docs(ci): record CI-057, CI-058 and CI-065 validation ledgers

[iperev]

Stacked PR 20 — base: #74 (feat/private-diagnostic-coordinates). Do not merge yet. Review only the top commit.

Context

CI-057 needs every blueprint validation class marked as covered, confirmed gap, not applicable or unresolved, with proof limits and cost. CI-058 needs the 225-scenario PostgreSQL intake conserved on current source. CI-065 (D9-C1) needs a bounded comparison ledger.

Provisional owner decisions (2026-10-11):

• Q3(a): a single machine-admitted owner, proofkit/ci-risk-coverage.v1.json.
• Q4(a): three-mechanism conservation, with all other scenarios "unknown (input deleted)" and no reconstruction.
• Q10: local owners only; no external candidate is admitted.

What changed

• Risk ledger: every row now has a ROADMAP disposition and a closure-cost class, and the three unnumbered blueprint sections have their own dispositions.
  • Static admission rejects a disposition that upgrades or erases the evidence state, an open row with no cost, a confirmed gap with no sized cost, and a missing or foreign section.
  • REQ-CI-PROOFKIT-012, the decision doc and the how-to are updated to match.
• CI-058: an intake-conservation section in database-observation-snapshots.md, covering the mechanism owners, the existing query-plan witnesses and the open question about plan witnesses for the logout fence.
• CI-065: a D9-C1 ledger (§8 of architecture-decision-quality.md) with 19 candidates: boundary contracts, transfer safeguards and testing guidance.
  • T-03 is bound to the existing full-row relation comparator, the staged-admission check and their witnesses. CI-047 keeps native qualification and activation.
  • B-06 states that a capability identifier keeps one descriptor; a changed descriptor needs a new versioned identifier.
• Backend witness: test_orders_keys_by_unicode_codepoint gains U+E000, so a backend UTF-16 key sort is now falsified, as the frontend vector already did.
• ROADMAP: rows CI-057, CI-058 and CI-065 updated.
• Generated: artifacts regenerated with the repository generator.

Expected result

• ci_matrix check reports 12 covered, 16 not applicable, 85 unresolved and 1 confirmed gap (DATA02 → CI-067), each open row with its cost class.
• Intake scenarios outside the three mechanisms stay "unknown (input deleted)".
• CI-065 adopts nothing and leaves one unresolved owner question (T-01, the authority-transition trigger wording).

Non-claims:

• No native, database, browser, provider or mutation witness was run, and the new and extended tests are unexecuted.
• No partial row is upgraded.
• This does not claim semantic completeness, global optimality or production readiness.
• No ROADMAP task is closed; closure needs merged exact-source qualification.

Independent review: gpt-6-astra (xhigh); findings addressed or rejected with reasons in the single commit. Provisional owner decisions (2026-10-11) are labelled in the changed documents.